GitHubMirror/sys
1
0
Fork 0
mirror of https://github.com/rwinkhart/sys.git synced 2026-09-05 16:47:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

windows: add dynamic exception function table manipulators

Browse Source 
These are useful for loading new code into the address space at runtime
and having exceptions be handled.

https://docs.microsoft.com/en-us/windows/win32/api/winnt/nf-winnt-rtladdfunctiontable
https://docs.microsoft.com/en-us/windows/win32/api/winnt/nf-winnt-rtldeletefunctiontable

Change-Id: I4fce4d7003d87cf48486d6e09d8543c2f1325554
Reviewed-on: https://go-review.googlesource.com/c/sys/+/357409
Trust: Jason A. Donenfeld <Jason@zx2c4.com>
Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Jason A. Donenfeld
2021-10-20 17:42:00 +00:00
parent 153b154469
commit 9d61738499
3 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
windows/syscall_windows.go
+2
View File
@@ -430,6 +430,8 @@ func NewCallbackCDecl(fn interface{}) uintptr {
//sys NtSetInformationProcess(proc Handle, procInfoClass int32, procInfo unsafe.Pointer, procInfoLen uint32) (ntstatus error) = ntdll.NtSetInformationProcess //sys NtSetInformationProcess(proc Handle, procInfoClass int32, procInfo unsafe.Pointer, procInfoLen uint32) (ntstatus error) = ntdll.NtSetInformationProcess
//sys NtQuerySystemInformation(sysInfoClass int32, sysInfo unsafe.Pointer, sysInfoLen uint32, retLen *uint32) (ntstatus error) = ntdll.NtQuerySystemInformation //sys NtQuerySystemInformation(sysInfoClass int32, sysInfo unsafe.Pointer, sysInfoLen uint32, retLen *uint32) (ntstatus error) = ntdll.NtQuerySystemInformation
//sys NtSetSystemInformation(sysInfoClass int32, sysInfo unsafe.Pointer, sysInfoLen uint32) (ntstatus error) = ntdll.NtSetSystemInformation //sys NtSetSystemInformation(sysInfoClass int32, sysInfo unsafe.Pointer, sysInfoLen uint32) (ntstatus error) = ntdll.NtSetSystemInformation
//sys RtlAddFunctionTable(functionTable *RUNTIME_FUNCTION, entryCount uint32, baseAddress uintptr) (ret bool) = ntdll.RtlAddFunctionTable
//sys RtlDeleteFunctionTable(functionTable *RUNTIME_FUNCTION) (ret bool) = ntdll.RtlDeleteFunctionTable
// syscall interface implementation for other packages // syscall interface implementation for other packages
windows/types_windows.go
+6
View File
@@ -2366,6 +2366,12 @@ type LIST_ENTRY struct {
Blink *LIST_ENTRY Blink *LIST_ENTRY
} }
type RUNTIME_FUNCTION struct {
BeginAddress uint32
EndAddress uint32
UnwindData uint32
}
type LDR_DATA_TABLE_ENTRY struct { type LDR_DATA_TABLE_ENTRY struct {
reserved1 [2]uintptr reserved1 [2]uintptr
InMemoryOrderLinks LIST_ENTRY InMemoryOrderLinks LIST_ENTRY
windows/zsyscall_windows.go
+14
View File
@@ -370,7 +370,9 @@ var (
procNtQuerySystemInformation = modntdll.NewProc("NtQuerySystemInformation") procNtQuerySystemInformation = modntdll.NewProc("NtQuerySystemInformation")
procNtSetInformationProcess = modntdll.NewProc("NtSetInformationProcess") procNtSetInformationProcess = modntdll.NewProc("NtSetInformationProcess")
procNtSetSystemInformation = modntdll.NewProc("NtSetSystemInformation") procNtSetSystemInformation = modntdll.NewProc("NtSetSystemInformation")
procRtlAddFunctionTable = modntdll.NewProc("RtlAddFunctionTable")
procRtlDefaultNpAcl = modntdll.NewProc("RtlDefaultNpAcl") procRtlDefaultNpAcl = modntdll.NewProc("RtlDefaultNpAcl")
procRtlDeleteFunctionTable = modntdll.NewProc("RtlDeleteFunctionTable")
procRtlDosPathNameToNtPathName_U_WithStatus = modntdll.NewProc("RtlDosPathNameToNtPathName_U_WithStatus") procRtlDosPathNameToNtPathName_U_WithStatus = modntdll.NewProc("RtlDosPathNameToNtPathName_U_WithStatus")
procRtlDosPathNameToRelativeNtPathName_U_WithStatus = modntdll.NewProc("RtlDosPathNameToRelativeNtPathName_U_WithStatus") procRtlDosPathNameToRelativeNtPathName_U_WithStatus = modntdll.NewProc("RtlDosPathNameToRelativeNtPathName_U_WithStatus")
procRtlGetCurrentPeb = modntdll.NewProc("RtlGetCurrentPeb") procRtlGetCurrentPeb = modntdll.NewProc("RtlGetCurrentPeb")
@@ -3200,6 +3202,12 @@ func NtSetSystemInformation(sysInfoClass int32, sysInfo unsafe.Pointer, sysInfoL
return return
} }
func RtlAddFunctionTable(functionTable *RUNTIME_FUNCTION, entryCount uint32, baseAddress uintptr) (ret bool) {
r0, _, _ := syscall.Syscall(procRtlAddFunctionTable.Addr(), 3, uintptr(unsafe.Pointer(functionTable)), uintptr(entryCount), uintptr(baseAddress))
ret = r0 != 0
return
}
func RtlDefaultNpAcl(acl **ACL) (ntstatus error) { func RtlDefaultNpAcl(acl **ACL) (ntstatus error) {
r0, _, _ := syscall.Syscall(procRtlDefaultNpAcl.Addr(), 1, uintptr(unsafe.Pointer(acl)), 0, 0) r0, _, _ := syscall.Syscall(procRtlDefaultNpAcl.Addr(), 1, uintptr(unsafe.Pointer(acl)), 0, 0)
if r0 != 0 { if r0 != 0 {
@@ -3208,6 +3216,12 @@ func RtlDefaultNpAcl(acl **ACL) (ntstatus error) {
return return
} }
func RtlDeleteFunctionTable(functionTable *RUNTIME_FUNCTION) (ret bool) {
r0, _, _ := syscall.Syscall(procRtlDeleteFunctionTable.Addr(), 1, uintptr(unsafe.Pointer(functionTable)), 0, 0)
ret = r0 != 0
return
}
func RtlDosPathNameToNtPathName(dosName *uint16, ntName *NTUnicodeString, ntFileNamePart *uint16, relativeName *RTL_RELATIVE_NAME) (ntstatus error) { func RtlDosPathNameToNtPathName(dosName *uint16, ntName *NTUnicodeString, ntFileNamePart *uint16, relativeName *RTL_RELATIVE_NAME) (ntstatus error) {
r0, _, _ := syscall.Syscall6(procRtlDosPathNameToNtPathName_U_WithStatus.Addr(), 4, uintptr(unsafe.Pointer(dosName)), uintptr(unsafe.Pointer(ntName)), uintptr(unsafe.Pointer(ntFileNamePart)), uintptr(unsafe.Pointer(relativeName)), 0, 0) r0, _, _ := syscall.Syscall6(procRtlDosPathNameToNtPathName_U_WithStatus.Addr(), 4, uintptr(unsafe.Pointer(dosName)), uintptr(unsafe.Pointer(ntName)), uintptr(unsafe.Pointer(ntFileNamePart)), uintptr(unsafe.Pointer(relativeName)), 0, 0)
if r0 != 0 { if r0 != 0 {